Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Local web server for static files, coming in a small package.
npx servitsy [directory] [options]
By default, servitsy
will:
http://localhost:8080
(listening on hostname 0.0.0.0
);8080
is not available;index.html
files for folders, and .html
files when the extension was omitted in the URL;See npx servitsy --help
— or the Options section — if you want to configure this behavior.
There are safer and faster tools to serve a folder of static HTML to the public. Apache, Nginx, fastify-static, etc.
… if you want nice dev features like live-reload, transpilation, bundling, etc. — use something like Vite instead.
There are good established alternatives to this package. Here is a brief and subjective comparison of a few packages I like:
Package | Size on disk† | Dependencies | Highlights |
---|---|---|---|
servitsy (v0.1.0) | 104 kB | 0 | Tiny |
servor (v4.0.2) | 144 kB | 0 | Tiny, some cool features |
sirv-cli (v2.0.2) | 392 kB | 12 | Small, good options |
serve (v14.2.3) | 7.6 MB | 89 | Good defaults, easy to use |
http-server (v14.1.1) | 8.9 MB | 45 | Good defaults, featureful |
The philosophy of servitsy
is to have few opinions and bells and whistles (like sirv-cli
), and to try to offer that in a zero-dependency package (like servor
).
If size and dependency count is not a concern and you want something stable and battle-tested, I recommend serve
and http-server
.
† Size on disk is the uncompressed size of the package and its dependencies (as reported by /usr/bin/du
on macOS with an APFS filesystem; exact size may depend on the OS and/or filesystem).
cors
Adds Cross-Origin Resource Sharing headers to responses. Defaults to false
.
Currently, setting this option to true
will add a Access-Control-Allow-Origin: *
header with every response (except directory listings).
# Enable
servitsy --cors
servitsy --cors true
# Disable (default)
servitsy --cors false
dirFile
File names to look up when a request matches a directory. Defaults to index.html
.
servitsy --dir-file 'index.html'
servitsy --dir-file 'page.html,page.htm'
dirList
Whether to list directory contents when a request matches a directory and no dirFile
is found. Defaults to true
.
# Enable (default)
servitsy --dir-list
servitsy --dir-list true
# Disable
servitsy --dir-list false
exclude
Block access to files and folders matched by the provided pattern(s). Patterns may use the wildcard character *
, but not slashes or colons (/
, \
or :
). Use a pattern starting with !
to negate an exclusion rule.
Defaults to blocking all dotfiles, except for .well-known
(see Well-known URI):
servitsy --exclude '.*' --exclude '!.well-known'
Patterns can also be provided as comma-separated values:
servitsy --exclude '.*,!.well-known'
Blocked requests will result in a 404 error. A request will be block if any file or folder name in the requested file's path matches an exclusion rule (while not matching a negative exclusion rule).
For example, if a request resolves to a readable file at <root_dir>/subfolder/data.json
, access will be:
--exclude 'sub*'
(fully matches subfolder
);--exclude '*.js*'
(fully matches data.json
);--exclude '.json'
(does not fully match data.json
).ext
File extensions to look for when resolving a request. Defaults to .html
.
Typically, this allows serving a page-name.html
file for a request URL path of /page-name
.
servitsy --ext '' # disable
servitsy --ext '.html' # default
servitsy --ext '.xhtml' --ext '.html'
header
Add custom HTTP headers to responses, for all files or specific file patterns. Headers can be provided using a header:value
syntax, or as a JSON string:
# header:value syntax
servitsy --header 'cache-control: max-age=5' --header 'server: servitsy'
# JSON syntax
servitsy --header '{"cache-control": "max-age=5", "server": "servitsy"}'
To add headers to specific responses, use file matching patterns before the value:
# header:value syntax
servitsy --header '*.rst content-type: text/x-rst'
# JSON syntax
servitsy --header '*.rst {"content-type": "text/x-rst"}'
See the exclude
option for more information about file matching patterns.
host
Host address that the server will listen on. May be a domain name or an IP address.
Defaults to 0.0.0.0
, which means that the server will be available both on http://localhost:<port>/
and from other computers connected to the same network.
servitsy --host localhost
servitsy --host mysite.local
port
Port number to use for the server. Three formats are supported:
servitsy --port 3000
servitsy --port 3000+
servitsy --port 8080-8099
<number>
: specify a single port number, will error out if that port is busy;<number>+
: specifies the first port number to try, and allow trying the next few port numbers if the first one is busy;<number>-<number>
: a range of port numbers to try (from first to last).Defaults to 8080+
.
FAQs
Small, local HTTP server for static files
The npm package servitsy receives a total of 20 weekly downloads. As such, servitsy popularity was classified as not popular.
We found that servitsy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.